nx_ed25519_signature.nx

nx_ed25519_signature.nx -- final Ed25519 verify + sign (RFC 8032 §5.1). Phase 0b §I.1.D of the Ed25519 completion arc per docs/NISHI_TLS13_GAP_AUDIT.md. Wires together all four shipped substrate pieces (field T7 + decompress T8 + arith T9 + scalar T10) into the final two callable signatures the rest of the substrate consumes: ed25519_sign(priv32, msg, msg_len, sig_out_64) ed25519_verify_full(pub32, msg, msg_len, sig_64) -> 1/0 Plus the helper sc_muladd that sign needs. Sign (RFC 8032 §5.1.6): 1. H = SHA-512(priv) ; 64 bytes 2. s = clamp(H[0..32]) ; 32 bytes (secret scalar) prefix = H[32..64] ; 32 bytes 3. A = [s]B ; public key A_enc = compress(A) 4. r = sc_reduce(SHA-512(prefix || msg)) ; 32 bytes R = [r]B R_enc = compress(R) ; 32 bytes 5. k = sc_reduce(SHA-512(R_enc || A_enc || msg)) ; 32 bytes 6. S = (k*s + r) mod L = sc_muladd(k, s, r) ; 32 bytes 7. signature = R_enc || S ; 64 bytes Verify (RFC 8032 §5.1.7): 1. Parse sig: R_enc (32) || S (32). Reject if S >= L. 2. Decompress R_enc -> R_pt; decompress pubkey -> A_pt. 3. h = sc_reduce(SHA-512(R_enc || pubkey || msg)) 4. Check: [S]B == R_pt + [h]A_pt (compare via compressed encoding) What it does today: both sign and verify, KAT-verified against RFC 8032 §7.1 TEST 1 (the empty-message vector). What it doesn't do yet: - TEST 2 (1-byte) and TEST 3 (1023-byte) KATs are mechanically the same; we ship TEST 1 to prove correctness and queue TEST 2/3 as exhaustive interop. - Constant-time signing (current sc_reduce is data-independent